CVE-2024-47827

MEDIUM EPSS 26.4%
Published Oct 28, 20241y ago · Modified Jun 17, 20261w ago
4.8 CVSS 3.1
Medium
Find Similar
Published Oct 28, 2024 1y ago
Last Modified Jun 17, 2026 1w ago

Description

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Due to a race condition in a global variable in 3.6.0-rc1, the argo workflows controller can be made to crash on-command by any user with access to execute a workflow. This vulnerability is fixed in 3.6.0-rc2.

CVSS Details

Base Score
4.8
Exploitability
1.2
Impact
3.6
Vector string
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Attack Vector Adjacent
Attack Complexity High
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality None
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
26.4% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 2

CWE-1108
CWE-362

Affected Products 1

VendorProductVersionRange
argoprojargo_workflows3.6.0any

References 4

  • github.com https://github.com/argoproj/argo-workflows/blob/ce7f9bfb9b45f009b3e85fabe5e6410de23c7c5f/workflow/metrics/metrics_k8s_request.go#L75
    Product
  • github.com https://github.com/argoproj/argo-workflows/commit/524406451f4dfa57bf3371fb85becdb56a2b309a
    Patch
  • github.com https://github.com/argoproj/argo-workflows/pull/13641
    Issue TrackingPatch
  • github.com https://github.com/argoproj/argo-workflows/security/advisories/GHSA-ghjw-32xw-ffwr
    Vendor Advisory

Remediation

  • github.com https://github.com/argoproj/argo-workflows/commit/524406451f4dfa57bf3371fb85becdb56a2b309a
    Patch
  • github.com https://github.com/argoproj/argo-workflows/pull/13641
    Issue TrackingPatch